The PHP2Shell vulnerability, comprising CVE-2026-109618 and CVE-2026-109619, received a CVSS 4.0 severity rating of 9.2. Both flaws involve memory corruption issues that allow unauthenticated remote code execution. The vulnerabilities stem from improper memory management during request processing, where incomplete data or freed memory references can be exploited to execute code with the privileges of the PHP process.
The PHP Foundation first identified memory exhaustion issues in 2024 but struggled to establish a clear remote code execution chain. Decision-making delays and resource constraints hindered the development of a fix. In August 2026, researchers from Calif provided evidence of remote code execution, prompting the foundation to restructure its decision-making processes and establish a dedicated security team in May 2026.
The release of patches in October 2026 was marked by coordination failures and leaks. Although the official release was scheduled for October 21, the container provider Chainguard released updated builds six hours early, citing independent discovery and the need to protect users. This premature release occurred after the leak of CVE identifiers and a demonstration video by Calif researchers.
Initial skepticism regarding the severity of PHP2Shell was widespread, with some researchers noting that public proof-of-concept exploits were often non-functional. However, subsequent reports confirmed successful attacks. By late October 2026, researchers documented exploitation campaigns, including one targeting Palo Alto Networks PAN-OS devices, where attackers combined PHP2Shell with the Fragnesia Linux kernel vulnerability.
The incident highlighted systemic challenges in open-source maintenance. Despite initiatives like the Linux Foundation's Core Infrastructure Initiative, the PHP Foundation continues to rely on external funding to support its developers. The incident underscored the necessity for companies that profit from open-source software to invest more actively in the maintenance and security of the projects they depend on.
